I need to be able to grant (and revoke) local, non-administrator users' access to a Windows 7 system in an automated fashion (i.e. not by using the System Properties control panel). Script, batch, registry file, or what have you is fine.

I had though this was as simple as adding the user to a "Remote Desktop" group (via, say, NET LOCALGROUPS), but the systems don't seem to have one.

Any ideas?

  • Have you tried "Remote Desktop Users" group?
    – joeqwerty
    Jan 22 '11 at 21:57
  • @joeqwerty — As I said, these systems don't have a "Remote Desktop Users" group. :-)
    – Ben Blank
    Jan 22 '11 at 22:11
  • 1
    You didn't say that, you said "Remote Desktop" group. The name of the group is "Remote Desktop Users". I know it seems like we should assume that you meant "Remote Desktop Users" but if we assume you mean something other than what you actually write then the answers here are not going to be very helpful.
    – joeqwerty
    Jan 22 '11 at 22:29

To add the user jscott to the group Remote Desktop Users:

net localgroup "Remote Desktop Users" jscott /ADD

If you're in an Active Directory domain environment, you can simply add a domain group (e.g., "Desktop Remote Users", or the like) to the local Remote Desktop Users group. Have a look at Group Policy Restricted Groups to manage these memberships. You can then manage the members of the domain group without having to update the workstations.

If the local group is missing, you will need to recreate it and assign it permissions. Create the group NET LOCALGROUP "Remote Desktop Users" /ADD, then open the local security policy editor secpol.msc and grant the group "Allow log on though Remote Desktop Services". You can also do this via Group Policy in a domain environment.

I would be curious to know how this group disappeared, if it was not just deleted. Perhaps another SF'er will know.

  • Okay, I can create and populate a "Remote Desktop Users" group via the console, but how do I grant it access to Remote Desktop?
    – Ben Blank
    Jan 22 '11 at 22:12
  • Ah-ha! Secpol did the trick. Thanks! :-)
    – Ben Blank
    Jan 22 '11 at 23:34

To change the security policy through the GUI following these steps : Click on the start button , control panels administrator tools, Computer management , "Local Users and Groups", Groups , Remote Desktop Users.

This window will list all the users that have remote access to the computer. If you dont see the username you want to use to login to the cmputer remotely , then click the "Add" button.

Next type the username. For domain users , be sure to include the domain in the username you add (ie if your domain is STUFF ) you'd enter STUFF\username. ( or just username if no domain ). Then click apply.

  • 2
    BTW, The question was to do this without using the GUI.
    – mdpc
    Nov 8 '11 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.